Patching is still one of security's hardest problems, despite years of tooling and budget. In an interview with Help Net Security, Qualys' Kunal Modasiya points out that a single vulnerability may require multiple patches or configuration changes to fully remediate. Even when a fix is ready, business leaders often block deployment for revenue-critical systems, and past patches that caused outages make teams cautious about repeating the mistake.
The industry's long-standing advice to "patch faster" has hit its limits. Modasiya argues that human-dependent workflows cap rollout speed even with automation, and that the bigger efficiency gains come from looking at the entire remediation process. AI can help by testing patches and guiding decisions on whether to deploy broadly, to a small subset, or automatically, based on risk reduction versus potential impact.
Proactive teams, he says, go beyond CVSS scores. They combine threat intelligence, asset inventory, and business impact to prioritize issues—especially those that are internet-facing or have active exploits. This allows them to move before a vulnerability lands on official must-patch lists and to adapt when a previously low-risk issue becomes part of an attack chain.
Rather than focusing on Mean Time To Remediation (MTTR), Modasiya suggests tracking Average Window of Exposure (AWE)—how long an organization remains exposed after a patch is released. This matters particularly for zero-days, where exposure can begin days before discovery and disclosure. With only one source, there are no conflicting views to compare, but the interview offers a clear case for shifting metrics and mindset around patching.